\(\operatorname{\mathbf {\ell }}_p\)  adversarial robustness.
Adversarial training in deep learning has been first considered in [1]} and later framed as a robust optimization problem by [2]}.
The view that adversarial training damages or at least does not improve the performance on common corruptions has been prevalent in the literature [3]}, [4]}, [5]}.
However, previous works directly use publicly available robust models without adjusting the perturbation radius used for adversarial training.
For example, [4]} show that adversarially trained ImageNet models from [7]}, [8]}, and [9]} do not help on ImageNet-C compared to standardly trained models.
However, [10]} report that \(\operatorname{\mathbf {\ell }}_\infty \)  adversarially trained models on CIFAR-10 from [2]} do lead to an improvement on CIFAR-10-C compared to a standard model.
The approach of [12]}, AdvProp, relies on \(\operatorname{\mathbf {\ell }}_\infty \)  adversarial training to improve standard and corruption accuracy but they advocate the use of auxiliary batch normalization layers for standard and adversarial training examples. We find that similar performance can be achieved on common corruptions using vanilla adversarial training without a customized use of BatchNorm layers.
[13]} study the robustness transfer between \(\operatorname{\mathbf {\ell }}_p\) -robust models and adversarially optimized elastic and JPEG corruptions. They show that \(\operatorname{\mathbf {\ell }}_p\)  adversarial training can increase robustness against these two types of adversarial perturbations, but robustness does not transfer in all the cases and sometimes may even hurt robustness against other perturbation types.
